MCP server

Pallyy runs a remote MCP server that lets AI assistants work in your account. MCP (Model Context Protocol) is the open standard assistants like Claude and ChatGPT use to call tools, so once the server is connected you can ask an assistant to list what's scheduled, draft a week of posts, import images, or pin a reminder to the calendar, and it does the work through Pallyy.

https://app.pallyy.com/mcp

Pallyy is also listed in Claude's connector directory and as a ChatGPT plugin, so Claude and ChatGPT users connect in one click without the URL. Every supported app has its own setup page, see connect an app.

The server exposes the same capabilities as the REST API, under the same rules: every connection can read, writes need scopes, and access can be limited to specific social sets. It is included on every plan, the free plan included, alongside the API, and the MCP server feature page walks through the setup for non-developers. For the general workflow with any AI app, see how to schedule social media posts with MCP, and for how Pallyy's server compares with other schedulers, see social media MCP servers.

What an assistant can do

The server offers 17 tools, each backed by a REST endpoint. In ChatGPT the assistant can also import an image generated or attached in the conversation; other clients import media from a public URL. See the tool reference for their inputs.

Tools return the same JSON objects the REST endpoints do, so the post set, media, media upload, note, and Pinterest boards pages describe what an assistant sees.

Every post set the assistant reads or writes can be opened in Pallyy's calendar with a link built from its socialSetId and id, which is the quickest way to review what an assistant scheduled:

https://app.pallyy.com/dashboard/scheduling/calendar/month?set=<socialSetId>&post=<postSetId>

Connect an app

Each supported app has its own page with the exact steps, the plan it needs, and the way it authenticates:

Connect any other client with an API key

Sign-in through the consent page works for clients that send you back to claude.ai, chatgpt.com, cursor.com, or a local address, see MCP authorization for why. Any other MCP client can use the server with an API key instead: send the key as a bearer token on every request and skip OAuth entirely.

Authorization: Bearer pallyy_your_api_key

Most clients accept extra headers in their server configuration. The per-app pages above show where. In Claude Code, for example:

claude mcp add --transport http pallyy https://app.pallyy.com/mcp \
  --header "Authorization: Bearer pallyy_your_api_key"

An API key carries its own scopes and social set restriction, so an assistant using one can do exactly what the key allows and nothing more.

Approving a connection

Approving a connection creates a grant for that app in your Pallyy account. The consent page shows:

• What the app will be able to do. Viewing your posts, media, and social sets is always included. Write permissions (Edit posts, Publish posts, Upload media, Edit notes) are listed only when the app asked for them, since the client chooses which scopes to request.
• Whether it stays connected. Apps that request offline_access keep working until you disconnect them. Otherwise the connection expires after an hour and the app asks you to connect again.
• Which social sets it can reach. Leave the picker empty to allow every current and future social set, or select specific sets to limit the app to those. Everything outside the selection answers as if it did not exist.

Click Authorize to finish, or Cancel to send the app back with no access. Each app gets one grant per account, so approving it again replaces the previous permissions rather than adding a second connection.

Managing connected apps

Every app you have approved is listed under Settings > Connected Apps with its permissions, the social sets it can reach, when it was connected, and when it was last used. Click Disconnect to revoke an app. It loses access immediately, including any tokens it still holds, and you can reconnect it at any time by approving it again.

Posts created or edited by a connected app show the app's name in the post's history, the same way posts made with an API key show the key's name.

How access works

The MCP server calls the REST API on the assistant's behalf, so the rules on the authentication page apply unchanged:

• Every connection can read. Creating or updating anything needs the matching scope, and scheduling a post that will actually publish needs post-sets:publish on top of post-sets:write.
• A connection limited to specific social sets only sees those sets. Resources in other sets return a 404.
• Plan limits are enforced by the social set's owner subscription: monthly post limits, video and carousel availability, and the media allowance all apply to posts an assistant creates.
• Tool calls count toward the rate limit of 5 requests per second, shared with your API keys.

Errors come back to the assistant as tool errors carrying the API's message, for example Pallyy API error (403): This connected app is missing the required scope: post-sets:publish. The errors page lists every code.

Transport details

The server speaks MCP's Streamable HTTP transport and is stateless: each POST to /mcp carries its own Authorization header and gets a JSON response, there are no sessions to open or close, and GET or DELETE requests answer 405. A request without a bearer token receives a 401 with a WWW-Authenticate header pointing at the authorization metadata, which is how clients discover that the server supports sign-in.